Not every team wants a language model near its code. Some want the full assistant. Some want to plug in a model they already approved. Safeguard supports all three, and you can choose per team and per need.
What it is
There are three ways Safeguard can use models.
Full AI. Safeguard's assistant and its models are on. You can ask questions in plain language, get explanations of findings and have the assistant propose fixes.
Zero AI. Everything runs without a model. The CLI's scanning, SBOM generation and findings work with no LLM involved. If your policy says no model may see your code or your data, this mode still gives you a working scanner.
Bring your own model. You plug in a model you choose. Claude, GPT, Mistral, Cohere and others can be connected, and on-prem and local models work too.
The CLI scanner has optional LLM source analysis. It is optional, not required.
Connecting your assistants
If you already use Claude or ChatGPT, you can connect Safeguard to them through MCP and bring your own model. That is a connection through MCP at mcp.safeguard.sh, and it works with Claude, ChatGPT, Cursor or an agent you build. It is not a way to reuse a subscription as a login or a payment method, so do not read it as one.
How to choose
| If your priority is | Pick |
|---|---|
| No model near source or data | Zero AI |
| The least setup and the full assistant | Full AI |
| A model your security team already approved | Bring your own model |
| A model that runs inside your own network | Bring your own model, on-prem or local |
A few practical points.
- Start with the question, not the mode. Ask your security team what data a model may see. The answer picks the mode for you.
- Zero AI is a real mode, not a trial. Scans and findings are not degraded by a missing model, because they never depended on one.
- You can switch. Inside the CLI terminal, the model command shows or switches the model, and an unknown name is rejected rather than quietly ignored.
- Mix per use. A team can use Zero AI in the pipeline and an approved model on a developer laptop.
Control at the edge
Tenant admins can switch off any client type, including MCP clients, ChatGPT and Claude. If a model path is not approved, it can be turned off for the whole tenant in one place.
Try it yourself
Take one repository. Run the CLI scan with no model, in Zero AI mode, and write down the findings count. Then run it with a model you have approved and compare. Note which findings changed and which explanations improved. Use that note when you decide the default for your team.
Quick check
Does Zero AI mean the scanner does less?
No. Scans and findings run without a model. Zero AI means no model is involved.
Can you use a model that runs on your own hardware?
Yes. Bring your own model supports on-prem and local models.
